config:
  storage: 50Gi
  storageClass: longhorn
  secretRef:
    db: null
    zipline: null
  domain: null
  maxUploadFileSize: 30m
zipline:
  # The upstream image ships no dedicated user, but the Node.js server runs
  # fine as an arbitrary non-root uid; fsGroup makes the uploads PVC writable.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: Always
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
  # Zipline v4 exposes /api/healthcheck (checks server and database health);
  # the endpoint is enabled by default (config.features.healthcheck). Since it
  # includes the database, it is used for readiness/startup only; liveness
  # uses "/" so a database outage does not restart the pod.
  livenessProbe:
    httpGet:
      path: /
      port: zipline-server
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: /api/healthcheck
      port: zipline-server
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Zipline runs database
  # migrations on startup, so grant a generous budget: 10s * 30 = 300s.
  startupProbe:
    httpGet:
      path: /api/healthcheck
      port: zipline-server
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
  resources:
    requests:
      cpu: 0.1
      memory: 265Mi
      ephemeralStorage: 100Mi
    limits:
      cpu: 1
      memory: 768Mi
      ephemeralStorage: 200Mi